Suntory Holdings, one of Japan's largest drinks makers, confirmed on November 2, 2026 that personal data was leaked after someone gained unauthorized access to an external cloud service the group uses. Kyodo News reports that the service was a Microsoft cloud platform. Kyodo puts the total at around 100,000 people, most of them employees. SmartScope's summary of the company's official apology leads with a figure of about 90,000 across seven categories of affected people. The gap probably comes from whether the headline counts only the largest group (employees and partner staff) or every category. Suntory says it has seen no misuse of the data so far. No threat actor has been named and no group has claimed the attack.
What Happened
Suntory Holdings and its listed subsidiary Suntory Beverage & Food jointly published a notice titled "Apology Regarding Personal Information Leak Due to Unauthorized Access to External Cloud Service." According to Kyodo, the company spotted unusual activity in a Microsoft cloud service on Wednesday, October 28, and cut off the unauthorized access. The disclosure came five days later.
SmartScope's summary of the official notice adds these points:
- The company's investigation found that files were downloaded from the cloud environment, and some of them held personal information.
- The intruder's access has been shut off.
- A preliminary report has gone to Japan's Personal Information Protection Commission, the national privacy regulator.
- Suntory has started contacting affected people directly.
Suntory has not said which Microsoft service was involved, such as SharePoint, OneDrive or Exchange Online. It has also not said how the intruder got in, how long they had access, or whether the attack used stolen credentials, a compromised account or a misconfiguration.
What Was Taken
Kyodo lists these categories of exposed data:
- About 90,000 employees of group companies and affiliated firms: names and email addresses
- About 7,300 people registered for Suntory's corporate activities experience program as of the end of 2023: email addresses
- About 7,200 applicants to the company's 2026 new-graduate recruitment process: names
Those three groups add up to roughly 104,500, which fits Kyodo's "around 100,000." SmartScope says the official notice lists seven categories in all, so Kyodo's breakdown may not cover every affected group. No report mentions financial data, government ID numbers or passwords.
The data itself is not very sensitive. What makes it dangerous is the combination: a verified list of about 90,000 corporate names and email addresses, matched to employer and affiliate, is exactly what an attacker needs for targeted phishing and impersonation. The job applicants and program registrants are mostly members of the public, many of them students. Messages that look like they come from Suntory or its recruiters are a likely next step.
Why It Matters
Suntory joins a fast-growing list of Japanese companies reporting breaches this autumn. In early October, The Japan Times reported disclosures from Daiwa Securities, GMO Research (up to 948,498 users), Rakuten Drive, the Nikkei media group, and Yakiniku King's parent Monogatari (about 10 million accounts). Those followed Park24's 6.6 million-account breach in late September. Chief Cabinet Secretary Minoru Kihara publicly said the government was concerned. On the day of Suntory's disclosure, Kyodo also reported that Paycloud Holdings had lost about 77 million email addresses through its subsidiary Arara. Separately, apparel group and ST HD told investors on October 23 that about 2.5 million customer records and about 10,000 business partner records may have been exposed in an attack on its operational servers.
Nothing public links these incidents to a single campaign, and their methods differ. The pattern still matters for defenders. Japanese companies are being hit at volume, and attackers are going after SaaS platforms and outside service providers rather than only on-premises networks. In Suntory's case, the company's own servers were not the entry point. The data sat in a Microsoft tenant, where identity controls decide who can get in.
The Attack Technique
Suntory has not disclosed how the attacker got in, and nothing published so far ties this incident to a particular method or group.
For context, Sophos X-Ops recently published an investigation into a separate, unnamed victim that shows how Microsoft 365 data theft at this scale often happens. That case is not linked to Suntory. In it, an attacker posing as help desk staff phoned employees and talked one of them through a self-service password reset. The attacker then took over the account, registered a device to keep a long-lived sign-in session (a Primary Refresh Token), and used Microsoft Graph to map the organization. From that single account, they downloaded nearly 100,000 SharePoint documents, accessed Salesforce, and exported about 2,500 user records from ServiceNow.
Suntory's description, unusual activity in a Microsoft cloud service followed by file downloads, fits that general pattern. It also fits several others, including stolen session tokens, password spraying, and risky permissions granted to a third-party app. Until Suntory or its investigators say more, the method is unknown.
What Organizations Should Do
- Lock down help desk and password reset processes. Require strong identity checks before any password or MFA reset done over the phone. Do not let self-service password reset rely on factors an attacker can get by calling the user.
- Watch for bulk downloads and Graph enumeration. Alert when one identity suddenly downloads large numbers of SharePoint or OneDrive files, or makes heavy directory and user-listing calls through Microsoft Graph.
- Control device registration and token lifetime. Restrict who can join or register devices in Entra ID, require compliant devices for access to sensitive data, and revoke sessions and refresh tokens as soon as an account is suspected of compromise.
- Keep personal data out of shared collaboration spaces. Recruitment files, program registration lists and staff directories should not sit in broadly shared SharePoint sites. Apply sensitivity labels and data loss prevention rules, and review access regularly.
- Warn affected groups about follow-up phishing. When names and emails leak, tell staff, partners and outside applicants that targeted phishing is likely. Publish official contact channels so people can check whether a message is really from you.
- Audit SaaS connections across the estate. One compromised Microsoft 365 identity can reach Salesforce, ServiceNow and other connected platforms. Review single sign-on scope, OAuth app permissions and service accounts together, not one platform at a time.
Sources: Suntory Holdings says personal data of around 100,000 people leaked | Beyond the mailbox: Graph reconnaissance and ServiceNow user enumer... | Suntory: Unauthorized Access to External Cloud Service Leaks Person... | Cyberattacks against Japanese firms continue, putting ... | Cybersecurity Analyst - Suntory Holdings Limited | Shinji Kita | List of data breaches | and ST HD Co.,Ltd. Notice of Unauthorized Server Access and Potenti...